NIST SSDF

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-01-30 Comment period closes on the SSDF 1.2 draft (SP 800-218 Rev. 1)
2. 2026-01-23 OMB M-26-05 rescinds M-22-18 and M-23-16; SSDF-based attestations become optional for federal agencies
3. 2025-12-17 SSDF 1.2 initial public draft (SP 800-218 Rev. 1) published; Executive Order 14306 requires the final version within 120 days of this preliminary update
4. 2025-06-06 Executive Order 14306 directs NIST to publish a preliminary SSDF update by 1 December 2025 and a final version within 120 days after it

1. 2025-12-17
   SSDF Version 1.2 (SP 800-218 Rev. 1, initial public draft) Draft

   Draft revision prepared under Executive Order 14306, with new and improved practices, tasks and examples for the secure and reliable development, delivery and improvement of software. source

   More

   • Comments closed 30 January 2026.
   • No final version had been published as of this check.
2. 2022-02-03
   SSDF Version 1.1 (SP 800-218) Major versionCurrent

   Moved the SSDF into a Special Publication, replacing the 2020 white paper that defined version 1.0. source

   More

   • Practices are grouped as Prepare the Organization (PO), Protect the Software (PS), Produce Well-Secured Software (PW) and Respond to Vulnerabilities (RV).
   • It includes mappings from Executive Order 14028 Section 4e clauses to SSDF practices and tasks.
3. 2021-09-30
   SSDF Version 1.1 (draft) Draft

   Draft of SP 800-218 released for comment; comments closed 5 November 2021. source

4. 2020-04-23
   SSDF Version 1.0 (CSWP 13) Major version

   First version, published as a NIST Cybersecurity White Paper, "Mitigating the Risk of Software Vulnerabilities by Adopting a Secure Software Development Framework (SSDF)". source

Nongovernmental organizations may use the SSDF voluntarily, and software producers and acquirers can use its common language.

Producers and acquirers

Nongovernmental organizations may use SP 800-218 voluntarily. Because the SSDF provides a common language for secure software development practices, software producers and acquirers can use it in procurement and other management activities. source source

2022 to January 2026

From 2022 to January 2026, OMB M-22-18 (amended by M-23-16) let federal agencies use covered software only if the producer attested to SSDF-based practices. source

Rescinded

OMB M-26-05 of 23 January 2026 rescinded both memoranda. source

Federal agencies now

Agencies must still keep a software and hardware inventory and set risk-based assurance policies. They may still use the attestation form and may cite SP 800-218. source

Organizations compare what they already do against the outcome-based practices to find gaps.

Gap analysis

The practices are outcome-based, and organizations compare what they already do against them to find gaps. source

Federal procurement

In federal procurement, the usual evidence was a self-attestation on CISA's common form, signed by the producer's CEO or a designee. source source

Since M-26-05

Since M-26-05 this attestation is at the buying agency's discretion and based on its risk assessment. source

NIST is not a regulatory agency; consequences come from the attestation form where an agency still collects it.

Not a regulator

NIST is not a regulatory agency. source

Missing attestation

Where an agency still collects an attestation, failing to provide one can mean the agency stops using the software. source

False statements

Willfully false or misleading information on the form may violate 18 U.S.C. § 1001, a criminal statute. source

1. Standard NIST SP 800-218 – SSDF Version 1.1 (PDF)
2. Standard NIST SP 800-218 Rev. 1 (initial public draft) – SSDF Version 1.2 (PDF)
3. Guidance NIST SP 800-218A – SSDF Community Profile for Generative AI and Dual-Use Foundation Models
4. Guidance NIST SSDF project page (practice table, changes in 1.1, community profiles)
5. Law text OMB M-26-05 – Adopting a Risk-based Approach to Software and Hardware Security

1. CISA SSDAF

   The CISA attestation form is the signed statement to a federal buyer that a producer follows selected SSDF practices; the SSDF is the underlying practice set.

2. EO 14028

   Executive Order 14028 (2021) ordered the guidance that became SSDF 1.1; SP 800-218 maps its practices to the order's Section 4e.

3. CRA

   The EU Cyber Resilience Act sets legally binding product security requirements; the SSDF is voluntary practice guidance without legal force of its own.

4. NIST SP 800-161

   SP 800-161 covers cybersecurity supply chain risk management for the acquiring organization; the SSDF covers how the producer builds the software.

5. OWASP

   OWASP is one of the community sources whose secure development practices the SSDF draws on and references.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to NIST SSDF (RSS)